CVE-2026-115479 Details

A vulnerability exists in baserCMS versions 5.2.5 prior to 5.3.2 and 5.4.0 prior to 5.4.2, where an unauthenticated visitor can exploit a public mail form by entering a comma-separated list of email addresses. This input is then used to send an auto-reply to multiple third parties simultaneously. The issue arises because the MailMessageMailer::sendFormToUser() function passes the user-controlled email input to parseAndNormalizeMailAddresses(), which splits the addresses using explode(',') and sends each one to setTo(). This vulnerability is present when the optional VALID_EMAIL server-side validation is not enabled, allowing crafted requests to bypass the browser's email format validation. The default contact form is not affected as it has the VALID_EMAIL validation enabled. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, facilitating the delivery of unsolicited mail in the site's name.

Users can update to baserCMS versions 5.3.2 or 5.4.2, where this vulnerability has been patched. Instructions for updating can be found in the baserCMS update guide.